Red Hat Security Advisory

RHSA-2025:23131

Red Hat Ansible Automation Platform 2.5 Container Release Update

Released 2025-12-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/eda-controller-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8 +2

TI-2025-38917 CVE-2025-62727 · GHSA-7f5h-v6xp-fcq8

HIGH 72

Starlette is a lightweight ASGI framework/toolkit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.008 Published 2025-10-28 Partial fix · 0.49.1 CWE-407

TI-2025-36412 CVE-2025-58754 · GHSA-4hjh-wcwx-xvwj

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01196 Published 2025-09-12 Partial fix · 1.12.0, 0.30.2 CWE-770

TI-2025-39861 CVE-2025-64459 · GHSA-frmv-pr5f-9mcr

HIGH 65

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.19257 Published 2025-11-05 Partial fix · 5.2.8, 5.1.14 +1 CWE-89

TI-2025-37061 CVE-2025-59530 · GHSA-47m2-4cr7-mhcw

LOW 39

quic-go is an implementation of the QUIC protocol in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00465 Published 2025-10-10 Partial fix · 0.49.1, 0.54.1 CWE-617

TI-2025-38897 CVE-2025-62707 · GHSA-vr63-x8vc-m265

LOW 36

pypdf is a free and open-source pure-python PDF library.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00444 Published 2025-10-22 Partial fix · 6.1.3 CWE-834

TI-2025-09094 CVE-2025-9909 · GHSA-2fx4-vwf2-pw99

LOW 31

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00184 Published 2026-02-27 Fixed in 3.1.1-1.el8ap, 25.12.0-1.el8ap +39 CWE-647

TI-2025-09093 CVE-2025-9908 · GHSA-c2g3-cfch-p5h4

LOW 31

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00219 Published 2026-02-27 Fixed in 3.1.1-1.el8ap, 25.12.0-1.el8ap +39 CWE-200

TI-2025-09092 CVE-2025-9907 · GHSA-3mcc-r9wq-f9g6

LOW 31

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00184 Published 2026-02-27 Fixed in 3.1.1-1.el8ap, 25.12.0-1.el8ap +39 CWE-200